Обсуждение: PostgreSQL 7.2.2: Security Release
Due to recent security vulnerabilities reported on BugTraq, concerning several buffer overruns found in PostgreSQL, the PostgreSQL Global Development Team today released v7.2.2 of PostgreSQL that fixes these vulnerabilities. The following buffer overruns have been identified and addressed: ... in handling long datetime input ... in repeat() ... in lpad() and rpad() with multibyte ... in SET TIME ZONE and TZ env var Although v7.2.2 is a purely plug-n-play upgrade from v7.2.1, requiring no dump-n-reload of the database, it should be noted that these vulnerabilities are only critical on "open" or "shared" systems, as they require the ability to be able to connect to the database before they can be exploited. The latest release is available at: ftp://ftp.postgresql.org/pub/sources/v7.2.2 As well as at appropriate mirror sites. Please report any bugs/problems with this release to: pgsql-bugs@postgresql.org Marc G. Fournier Co-ordinator PostgreSQL Global Development Group
In article <20020824000845.Q1769-100000@mail1.hub.org>, scrappy@hub.org ("Marc G. Fournier") wrote: > Due to recent security vulnerabilities reported on BugTraq, concerning > several buffer overruns found in PostgreSQL, the PostgreSQL Global > Development Team today released v7.2.2 of PostgreSQL that fixes these > vulnerabilities. might i recommend posting this to announce, as well? i never saw it show up there, and i certainly know some people who only read the announce list. if it was there, then the subsidiary problem is that announce is not working on the news server... FYI. -tfo